>> Trac HTML WikiProcessor "SRC" Tag Cross Site Scripting Vulnerability
Title : Trac HTML WikiProcessor "SRC" Tag Cross Site Scripting Vulnerability VUPEN ID : VUPEN/ADV-2006-0226 CVE ID : CVE-2005-4644
Rated as : Low Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2006-01-17
Technical Description
A vulnerability has been identified in Trac, which may be exploited by attackers to execute arbitrary scripting code. This flaw is due to an input validation error in the HTML WikiProcessor that does not properly validate certain "IMG SRC" tags, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser in the security context of an affected Web site.
